A trusted setting is proposed through the settings verb and set only on the operator's warrant (hq ADR 0277)

Issue 339 made every trusted setting the controller's terminal's alone, so an agent could only hand the
operator a line to type at the control node. Now anyone the bus admits may PROPOSE a layer: settings
propose keeps the proposal in the controller's own asks (the asked bucket, which the controller alone
writes), judged as settings set judges, and asks the operator on the operator channel at the level
approve with every key, its exact new value (in its shape where a path or an address may not leave the
mesh), the was of a changed key, the removed keys and the layer's fingerprint. The serving controller
sets the layer on the warrant alone: once, for the ask it holds, only when the record's values still
digest to what the option bound and the layer is still the one shown, with the terminal's judgement and
history, and keeps who approved it beside the layer, which settings says back (migration 0090). Decline,
expiry, a cancel, a replacement or the router's refusal discard it; nothing is asked when no router, no
grant or no channel can carry it. settings proposals lists them. The push afterwards is a separate act.

internal/inventory/unseen.go

@@ -44,6 +44,31 @@ type PastLayer struct {
 	ReplacedAt time.Time
 	// ReplacedBy is "set" or "clear".
 	ReplacedBy string
+	// SetBy is who had set the layer, when it was kept (novox/hq ADR 0277); empty for one set before that was kept.
+	SetBy string
+}
+
+// LayerOrigin is who set a layer and when (novox/hq ADR 0277): empty words for a layer set before who set it was
+// kept, and has false where there is no layer.
+func (i *Inventory) LayerOrigin(ctx context.Context, nodeName, module string) (setBy string, setAt time.Time, has bool, err error) {
+	nodeID, err := i.layerNode(ctx, nodeName)
+	if err != nil {
+		return "", time.Time{}, false, err
+	}
+	var by *string
+	err = i.store.Pool().QueryRow(ctx,
+		`select set_by, set_at from settings where module = $1 and node is not distinct from $2::uuid`,
+		module, nodeID).Scan(&by, &setAt)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return "", time.Time{}, false, nil
+	}
+	if err != nil {
+		return "", time.Time{}, false, err
+	}
+	if by != nil {
+		setBy = *by
+	}
+	return setBy, setAt, true, nil
 }
 
 // SettingsHistory is every layer of one module on one machine — the whole mesh's when nodeName is
@@ -54,7 +79,7 @@ func (i *Inventory) SettingsHistory(ctx context.Context, nodeName, module string
 		return nil, err
 	}
 	rows, err := i.store.Pool().Query(ctx,
-		`select values, set_at, replaced_at, replaced_by from settings_history
+		`select values, set_at, replaced_at, replaced_by, set_by from settings_history
 		  where module = $1 and node is not distinct from $2::uuid order by replaced_at desc`,
 		module, nodeID)
 	if err != nil {
@@ -65,9 +90,13 @@ func (i *Inventory) SettingsHistory(ctx context.Context, nodeName, module string
 	for rows.Next() {
 		var raw []byte
 		var p PastLayer
-		if err := rows.Scan(&raw, &p.SetAt, &p.ReplacedAt, &p.ReplacedBy); err != nil {
+		var by *string
+		if err := rows.Scan(&raw, &p.SetAt, &p.ReplacedAt, &p.ReplacedBy, &by); err != nil {
 			return nil, err
 		}
+		if by != nil {
+			p.SetBy = *by
+		}
 		if err := json.Unmarshal(raw, &p.Values); err != nil {
 			return nil, err
 		}
@@ -78,8 +107,8 @@ func (i *Inventory) SettingsHistory(ctx context.Context, nodeName, module string
 
 // keepReplacedSQL copies a layer into the history before it is replaced or cleared; run in the same
 // transaction as the write where there is one, so a write that fails leaves no history of it.
-const keepReplacedSQL = `insert into settings_history (node, module, values, set_at, replaced_by)
-	select node, module, values, set_at, $3 from settings
+const keepReplacedSQL = `insert into settings_history (node, module, values, set_at, replaced_by, set_by)
+	select node, module, values, set_at, $3, set_by from settings
 	 where module = $1 and node is not distinct from $2::uuid`
 
 // layerNode is the node id of a layer, nil for the whole mesh's.